CVE-2015-5477

● Known-exploited HIGH ⚠ Exploit

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

Affects 19 products across 12 vendors.

CVSS 3.17.5
EPSS99.4%
Percentile100th
PatchUnknown
Known-exploited since2026-10-08
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, no integrity impact, full availability impact.
CWE Weakness Definitions
CWE-19: CWE-19
CWE-617: CWE-617
◆ AI Analysis — automated analysis, not human-reviewed

A vulnerability in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service through TKEY queries, leading to a REQUIRE assertion failure and daemon exit.

BSID: BS-2015-GLOBAL-190178-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2015-5477?
A vulnerability in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service through TKEY queries, leading to a REQUIRE assertion failure and daemon exit.
What is the CVSS score for CVE-2015-5477?
CVE-2015-5477 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS: 99.4%.
Is CVE-2015-5477 actively exploited?
Yes. CVE-2015-5477 is in the CISA known-exploited catalog (added 2026-10-08). Active exploitation confirmed. Immediate patching required.
How do I remediate CVE-2015-5477?
Priority: HIGH. PSIRT: [email protected]
What systems are affected by CVE-2015-5477?
CVE-2015-5477 affects Apple Os X Server; Canonical Ubuntu Linux; Debian Debian Linux; Fedoraproject Fedora; Hp Hp-Ux, Openvms; Isc Bind; Juniper Junos; Netapp Clustered Data Ontap; Opensuse Evergreen (plus 9 more products across 3 more vendors).
Vulnerability Details
CVE IDCVE-2015-5477
BSIDBS-2015-GLOBAL-190178-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published2015-07-29
Last Modified2026-10-09
ICS Relevance75%
Weakness (CWE)
CWE-19CWE-617
SourceNVD
Official Description

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The attack vector involves sending specially crafted TKEY queries to the DNS server, which can trigger a REQUIRE assertion failure, causing the BIND daemon to exit and resulting in a denial of service.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Apple Os X Server 4.1.5
Canonical Ubuntu Linux 12.04
Debian Debian Linux 7.0 8.0
Fedoraproject Fedora 21 22
Hp Hp-Ux 11.11 11.23 11.31
Hp Openvms 5.7
Isc Bind ≤ 9.10.2
Juniper Junos 12.1 12.1r 12.1x44 12.1x45 12.1x46 12.1x47
+15 more12.3 12.3x48 12.3x50 13.2 13.2x51 14.1 14.1x50 14.1x51 14.1x53 14.2 15.1 15.1x49 15.1x53 < 12.1 ≥ 13.1, < 13.2
Netapp Clustered Data Ontap No version listed by source
Opensuse Evergreen 11.4
Opensuse Opensuse 13.1 13.2
Oracle Vm Server 3.2
Oracle Solaris 10 11.2
Redhat Enterprise Linux Aus 6.4 6.5 6.6
Redhat Enterprise Linux 5.0 6.0 7.0
Suse Linux Enterprise Debuginfo 11
Suse Linux Enterprise Software Development Kit 11 12
Suse Linux Enterprise Server 10 11 12
Suse Linux Enterprise Desktop 11 12
Hpe Dns 9.2.3 9.3
Hpe Vcx < 9.8.18
Remediation

No official vendor advisory link on record. See the CVE record →

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 4096 Days
CISA known-exploited● Active Exploitation Confirmed (added 2026-10-08)
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
Related CVEs affecting Apple
CVE-2012-0751 10.0 The ActiveX control in Adobe Flash Player before 10.3.183.15 and 11.x before ... CVE-2011-2452 10.0 Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows,... CVE-2012-4151 10.0 Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows a... CVE-2012-4153 10.0 Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows a... CVE-2012-4159 10.0 Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows a...
View all Apple CVEs →

This Vulnerability Is Being Actively Exploited

CVE-2015-5477 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.

Create a free account →